deployment.yaml

on:
  push:
    branches:
      - production
    paths-ignore:
      - '**.md'
      - '**.*ignore'
      - renovate.json
      - '**integration.yaml'

env:
  CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
  TF_CLOUD_ORGANIZATION: ${{ secrets.TF_CLOUD_ORGANIZATION }}
  TF_VAR_cloudflare_api_token: ${{ secrets.TF_VAR_CLOUDFLARE_API_TOKEN }}

jobs:
  deployment:
    name: Deploy to production
    runs-on: ubuntu-22.04
    permissions: read-all

    steps:
      - name: Checkout repository
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
        with:
          fetch-depth: 0

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3.0.0
        with:
          cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

      - name: Setup pnpm
        uses: pnpm/action-setup@v3.0.0

      - name: Set Nx SHAs
        uses: nrwl/nx-set-shas@v4
        with:
          main-branch-name: production

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build affected projects
        run: pnpm affected:build

      - name: Provision infrastructure
        run: terraform init && terraform apply -auto-approve

      - name: Deploy affected projects
        run: pnpm affected:deploy